Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed documentation-generation skill, with some operationally broad but visible behavior such as bilingual docs and local git commits.
Install this if you want an agent-guided README and changelog workflow. Before running it, decide whether you want Portuguese translations and auxiliary docs, and tell the agent not to create a branch or commit unless you explicitly approve those repository changes.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
npm install
# Configure
cp .env.example .env # then edit values
# Run
npm run dev
The skill claims to generate or update README.md and CHANGELOG.md, but it also directs creation of additional files under docs/en/, docs/pt/, and a translated README.pt-br.md. This is a scope expansion that can lead to broader repository modifications than the user may expect from the skill name and description, increasing the chance of unwanted file creation and review burden.
The skill hardcodes English as the primary README language and requires Portuguese translations regardless of repository context or user preference. This imposes a fixed product/documentation policy that can produce unnecessary changes, override established project conventions, and create misleading or low-quality content when no translation requirement exists.
The skill goes beyond documentation generation by instructing the agent to create a new git branch and make a commit. Those actions modify repository state and history, which increases operational scope from content authoring to source-control mutation. In an automated agent context, this can cause unintended side effects, bypass user review, or conflict with least-privilege expectations for a documentation skill.
The verification checklist enforces Portuguese documentation generation in all cases, reinforcing unconditional multilingual output even when unsupported by the repository or user request. In agent workflows, rigid policy like this can systematically trigger unnecessary edits across many files and reduce user control over changes.
No suspicious patterns detected.